Background

CMA currently exposes metrics on two ports via the 0.0.0.0 all hosts binding. We need to make sure that only the TLS port is accessible from outside localhost.

Steps

• Move the binding for the local metrics server to localhost only
• Ensure kube-rbac-proxy is still proxying the requests over TLS

Stakeholders

• Cluster Infra
• Subin M

Definition of Done

• Metrics from CMA are only exposed over TLS

• Docs

• <Add docs requirements for this card>

• Testing

• <Explain testing that will be added>